Skip to content

v0.1.2

Choose a tag to compare

View all tags
@github-actions github-actions released this 14 Aug 12:34
· 6 commits to main since this release
v0.1.2
a2e743e

What's new in v0.1.2

This release replaces the socat forwarder with a Caddy reverse proxy that makes remote access
fully functional — including settings and credentials — and establishes the proxy as the security
boundary.

Fixes & improvements

  • Caddy reverse proxy instead of socat — the container now runs a Caddy proxy on 0.0.0.0:3081
    that rewrites Host/Origin to loopback before forwarding to dsh web on 127.0.0.1:3080.
    dsh itself still listens on loopback only (both npm releases and upstream main reject
    --host 0.0.0.0 — an intentional upstream safety design; verified against the upstream source).
  • Remote access now works for every endpoint — dsh's /api browser-trust fence checks HTTP
    headers only, so the loopback rewrite lets remote browsers pass everything, including
    settings.*, credentials.*, agentPreset.*, host.pickDirectory/host.openPath and
    llm.discoverModels, which upstream hard-pins to loopback. The
    transport failure for /api/settings.describe: HTTP 403 errors over remote access are gone.
  • The proxy is the security boundary — because the rewrite bypasses the loopback pin, anyone
    who can reach port 3081 can read and modify all settings and credentials, not just drive the
    agent. Enable basic auth with DSH_PROXY_USER / DSH_PROXY_PASSWORD (recommended for any
    non-loopback deployment) and keep the port firewalled.
  • DSH_TRUSTED_HOSTS removed — the header rewrite makes trust configuration unnecessary; the
    compatibility layer is gone and the proxy is the one and only exposure path.
  • Docs, examples, and CI aligned — README (EN + 中文), deployment and security guides,
    compose/Quadlet examples, the CI smoke test (settings.describe through the proxy returns 200;
    basic auth returns 401 without / 200 with credentials), and AGENTS.md all reflect the
    proxy-only design.

Breaking changes (vs v0.1.1)

  • DSH_TRUSTED_HOSTS / --trusted-host are no longer supported — remove them from your
    configuration (they are no longer needed).
  • Exposure port stays 3081; port mappings are unchanged.
  • Anyone reaching 3081 now also gets settings/credentials access — enable
    DSH_PROXY_USER/DSH_PROXY_PASSWORD for non-loopback deployments.

Upgrade note

Pull the new image and recreate the container. Remove DSH_TRUSTED_HOSTS and, if you expose the
port beyond loopback, add DSH_PROXY_USER / DSH_PROXY_PASSWORD (basic auth).

Assets 2
Loading